@starci/hfs 4.8.0 → 4.9.0

package/runtime/scripts/lib/managed-json.mjs

@@ -1,51 +0,0 @@
-// managed-json.mjs - which JSON files are managed canon rather than authored JSON (knowledge/hfs/slots.yaml `managedBy` /
-// `liteManagedBy`): a template of @starci/hfs that a managed slot names (templates/<scope or common>/<group>/<path, each leading dot
-// dropped>), declared by the slot manifest and nowhere else, and an app's render of one, which `starci app sync` writes. Only a template
-// with no `{{variable}}` is a render candidate, and only a file whose text equals that template (line endings aside) is its render:
-// a file that differs in any byte stays authored.
-import { braceVariants } from './glob.mjs';
-
-const SIDES = Object.freeze(['be', 'fe']);
-const lf = (text) => String(text).replace(/\r\n/g, '\n');
-/** A literal file path of a slot (no wildcard or variable): only those are whole managed files. */
-const literal = (file) => !/[*?[<]/.test(file);
-const undotted = (file) => file.split('/').map((segment) => segment.replace(/^\./, '')).join('/');
-
-/** The scope (app, be or fe) and scope-relative path of an app-relative path, one per profile a slot may hold it in. */
-const placementsOf = (appRel) => [
-  { scope: 'app', file: appRel },
-  ...SIDES.filter((side) => appRel.startsWith(`${side}/`)).map((side) => ({ scope: side, file: appRel.slice(side.length + 1) })),
-];
-
-/**
- * The template names (relative to the @starci/hfs templates folder) a managed slot of `manifest` renders `appRel` from, in every
- * edition: [] when no managed slot lists that literal file.
- */
-export function managedTemplatesOf(manifest, appRel) {
-  const placements = placementsOf(appRel);
-  const matches = managedFilesOf(manifest).filter((managed) => placements.some(({ scope, file }) => managed.scope === scope && managed.file === file));
-  return [...new Set(matches.map((managed) => managed.name))];
-}
-
-/** Every literal file of every managed slot, with its scope and the template name it is rendered from: [{scope, file, name}]. */
-function managedFilesOf(manifest) {
-  return (manifest?.slots ?? []).flatMap((slot) => {
-    const groups = [...new Set([slot.managedBy, slot.liteManagedBy].filter((group) => typeof group === 'string'))];
-    const paths = [slot.path, slot.lite?.path].filter((value) => typeof value === 'string').flatMap((value) => braceVariants(value)).filter(literal);
-    return (slot.profiles ?? []).flatMap((scope) => paths.flatMap((file) => groups.flatMap((group) =>
-      [scope, 'common'].map((dir) => ({ scope, file, name: `${dir}/${group}/${undotted(file)}` })))));
-  });
-}
-
-/**
- * Every template name a managed slot of `manifest` declares (its literal files in each profile, edition group and scope or common
- * folder): the canon source `starci app sync` renders from, which the slot manifest itself names, so a template is declared there and
- * nowhere else.
- */
-export function declaredTemplateNames(manifest) {
-  return new Set(managedFilesOf(manifest).map((managed) => managed.name));
-}
-
-/** Whether `text` is the render of one of `templates` ([{name, text}]): a template with no variable whose text equals it. */
-export const isManagedRender = (text, templates) =>
-  templates.some((template) => typeof template.text === 'string' && !template.text.includes('{{') && lf(template.text) === lf(text));

package/runtime/scripts/lib/menu-parts.mjs

@@ -1,11 +0,0 @@
-// The parts the Kernel menu and the Supervisor menu share: a template filled from an item's subject, the escape option every
-// item carries, and the plain words of a starci call a seat table is read by.
-
-/** `template` with each `{key}` replaced by the subject's value; a key the subject does not know stays as written. */
-export const fillTemplate = (template, subject) => String(template ?? '').replace(/\{(\w+)\}/g, (match, key) => (subject[key] == null ? match : String(subject[key])));
-
-/** The escape option of a menu catalog (`escape: {choice, effect}`): no step, a reason as its text. */
-export const escapeOptionOf = (escape, extra = {}) => ({ choice: escape.choice, ...extra, steps: [], effect: escape.effect, text: 'reason', escape: true });
-
-/** The first `count` words of an argument list that are not options. */
-export const plainWords = (args, count) => args.filter((value) => !String(value).startsWith('-')).slice(0, count).map(String);

package/runtime/scripts/lib/op-gate.mjs

@@ -1,15 +0,0 @@
-// op-gate.mjs — one section of the runtime's knowledge/op-gate.yaml (testWorld, unitKit, ...):
-// {required, forbidden, outage, ...} as authored. An absent section reads as {}.
-import fs from 'node:fs';
-import path from 'node:path';
-import { parseYaml } from '../../engine/yaml.mjs';
-
-/** The `section` object of knowledge/op-gate.yaml under `runtime`, {} when the doc omits it. Throws when the file is unreadable. */
-const opGateSection = (runtime, section) =>
-  (parseYaml(fs.readFileSync(path.join(runtime, 'knowledge', 'op-gate.yaml'), 'utf8'))?.[section]) ?? {};
-
-/** The {required, forbidden, outage} rule lists of a gate `section` (absent lists read as []). */
-export const opGateRules = (runtime, section) => {
-  const rules = opGateSection(runtime, section);
-  return { required: rules.required ?? [], forbidden: rules.forbidden ?? [], outage: rules.outage ?? [] };
-};

package/runtime/scripts/lib/provision-control-failure.mjs

@@ -1,32 +0,0 @@
-// provision-control-failure.mjs - why `starci provision <plan|show|accept>` could not read or accept a prepared operation, as one public code and one
-// value-free detail line. Pure: the caller (scripts/gates/provision-operation.mjs runProvisionControl) names the stage that failed and passes the error;
-// this never serializes an error message, which may quote a provider body or a value, only the error's own identifier.
-// The case that motivated it: an operation prepared by a lane runtime keeps its plan blob in THAT runtime's blob store, and the published CLI reading it
-// from another runtime found the ledger row but not the blob; a blanket `provision-control-unavailable` hid that.
-
-/** The stages of the control verb, in the order it runs them. */
-export const PROVISION_CONTROL_STAGES = Object.freeze(['ledger', 'plan', 'target', 'accept']);
-
-const IDENTIFIER = /^[A-Za-z][A-Za-z0-9_.-]{0,63}$/u;
-const SHA = /^[a-f0-9]{64}$/u;
-
-/** The error's own code (ERR_SQLITE_ERROR, ENOENT) or class name, never its message; null when it has neither. */
-export function errorIdentifier(error) {
-  return [error?.code, error?.name].find((value) => typeof value === 'string' && IDENTIFIER.test(value)) ?? null;
-}
-
-/**
- * {code, detail} for a failure of the control verb at `stage`. A plan blob the ledger names but this runtime's blob store does not hold is
- * `provision-plan-blob-missing`; every other failure stays `provision-control-unavailable` with the stage and the error's identifier.
- */
-export function provisionControlFailure(error, { stage, planSha = null, operationId = null } = {}) {
-  if (!PROVISION_CONTROL_STAGES.includes(stage)) throw new TypeError(`unknown provision control stage: ${String(stage)}`);
-  const id = errorIdentifier(error);
-  if (stage === 'plan' && id === 'ENOENT') {
-    const blob = typeof planSha === 'string' && SHA.test(planSha) ? `the plan blob ${planSha.slice(0, 12)}` : 'the plan blob';
-    const operation = typeof operationId === 'string' && IDENTIFIER.test(operationId) ? ` of operation ${operationId}` : '';
-    return { code: 'provision-plan-blob-missing', detail: `${blob}${operation} is not in this runtime's blob store: the operation was prepared by another runtime; run the control with the runtime that prepared it, or prepare the operation again with this one` };
-  }
-  const named = id ? ' (' + id + ')' : '';
-  return { code: 'provision-control-unavailable', detail: `the ${stage} stage failed${named}; the operation journal holds its state` };
-}

package/runtime/scripts/lib/release-version.mjs

@@ -1,134 +0,0 @@
-// release-version.mjs - the one reading of a release version (owner ruling release-waves). A prerelease `<label>.N` opens the release
-// line N and `<label>.N.M` is the M-th release after it, a wave or a fix alike, so alpha.31 < alpha.31.1 < alpha.31.2 < alpha.32 in
-// SemVer order. The next release is derived from the highest one already released, never guessed. The legacy `<label>.N-fix.K` still
-// reads as release K after `<label>.N` and is never produced again. Pure: the callers read the tags and the registry.
-
-const NUMERIC = /^(?:0|[1-9]\d*)$/;
-const POSITIVE = /^[1-9]\d*$/;
-const IDENTIFIERS = /^[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*$/;
-const LEGACY_FIX = '-fix.';
-
-/** {base, wave, legacy}: the release a version counts its waves from, and its wave M (0 for the release that opens the line). */
-export function waveOf(version) {
-  const text = String(version ?? '').split('+')[0];
-  const fix = text.lastIndexOf(LEGACY_FIX);
-  const legacyWave = fix > 0 ? text.slice(fix + LEGACY_FIX.length) : '';
-  if (POSITIVE.test(legacyWave)) return { base: text.slice(0, fix), wave: Number(legacyWave), legacy: true };
-  const ids = text.split('.');
-  const counted = ids.length > 3 && POSITIVE.test(ids.at(-1)) && (text.includes('-') ? NUMERIC.test(ids.at(-2)) : ids.length === 4);
-  return counted ? { base: ids.slice(0, -1).join('.'), wave: Number(ids.at(-1)), legacy: false } : { base: text, wave: 0, legacy: false };
-}
-
-/** Parsed SemVer identifiers {core, pre} of `version`; an unreadable version throws. */
-export function versionParts(version) {
-  const parts = typeof version === 'string' ? version.split('+') : [];
-  if (!parts.length || parts.length > 2 || (parts.length === 2 && !IDENTIFIERS.test(parts[1]))) throw new Error(`unreadable release version ${version}`);
-  const boundary = parts[0].indexOf('-');
-  const core = (boundary < 0 ? parts[0] : parts[0].slice(0, boundary)).split('.');
-  const prerelease = boundary < 0 ? null : parts[0].slice(boundary + 1);
-  if (core.length !== 3 || core.some((part) => !NUMERIC.test(part)) || (prerelease !== null && !IDENTIFIERS.test(prerelease))) throw new Error(`unreadable release version ${version}`);
-  const pre = prerelease?.split('.') ?? [];
-  if (pre.some((part) => /^0\d+$/.test(part))) throw new Error(`invalid numeric prerelease identifier in ${version}`);
-  return { core: core.map(BigInt), pre };
-}
-
-const readable = (version) => {
-  try {
-    versionParts(version);
-    return true;
-  } catch {
-    return false;
-  }
-};
-
-/** The SemVer spelling a version is ordered by: a legacy `-fix.K` orders as wave K of its line. */
-const ordered = (version) => {
-  const { base, wave, legacy } = waveOf(version);
-  return legacy ? `${base}.${wave}` : version;
-};
-
-const compareIdentifier = (a, b) => {
-  const numericA = /^\d+$/.test(a), numericB = /^\d+$/.test(b);
-  if (numericA && numericB) return BigInt(a) < BigInt(b) ? -1 : Number(BigInt(a) > BigInt(b));
-  if (numericA !== numericB) return numericA ? -1 : 1;
-  return a < b ? -1 : Number(a > b);
-};
-
-/** SemVer precedence, numeric prerelease identifiers included; build metadata has no precedence. */
-export function compareVersions(a, b) {
-  const left = versionParts(ordered(a)), right = versionParts(ordered(b));
-  for (const i of left.core.keys()) {
-    if (left.core[i] !== right.core[i]) return left.core[i] < right.core[i] ? -1 : 1;
-  }
-  if (!left.pre.length || !right.pre.length) return Number(!left.pre.length) - Number(!right.pre.length);
-  for (let i = 0; i < Math.max(left.pre.length, right.pre.length); i += 1) {
-    if (left.pre[i] === undefined) return -1;
-    if (right.pre[i] === undefined) return 1;
-    const compared = compareIdentifier(left.pre[i], right.pre[i]);
-    if (compared) return compared;
-  }
-  return 0;
-}
-
-/** The release line of `version`: a prerelease's core and the identifiers before its first number (every alpha.N and alpha.N.M share one), a stable release's major and minor. */
-export function releaseLine(version) {
-  const { core, pre } = versionParts(ordered(version));
-  if (!pre.length) return `${core.slice(0, 2).join('.')}-stable`;
-  const first = pre.findIndex((id) => /^\d+$/.test(id));
-  return `${core.join('.')}-${(first < 0 ? pre : pre.slice(0, first)).join('.')}`;
-}
-
-/** {family, line} of a release that opens a line (`<x.y.z>-<label>.N`), or null for any other shape. */
-function lineStart(base) {
-  if (!readable(base)) return null;
-  const { core, pre } = versionParts(base);
-  return pre.length === 2 && !/^\d+$/.test(pre[0]) && NUMERIC.test(pre[1]) ? { family: `${core.join('.')}-${pre[0]}`, line: Number(pre[1]) } : null;
-}
-
-/** The next wave after `version`: its base with M one past the highest wave of that base among `version` and `known`. */
-export function nextWave(version, known = []) {
-  const { base } = waveOf(version);
-  const waves = [version, ...known].map(waveOf).filter((entry) => entry.base === base).map((entry) => entry.wave);
-  return `${base}.${Math.max(0, ...waves) + 1}`;
-}
-
-/** The family of a version: its core and label up to `-<label>` (`1.0.0-alpha`), or null for a stable or unlabelled version. */
-export function familyOf(version) {
-  if (!readable(version)) return null;
-  const { core, pre } = versionParts(ordered(version));
-  return pre.length && !/^\d+$/.test(pre[0]) ? `${core.join('.')}-${pre[0]}` : null;
-}
-
-/**
- * What may follow the highest line-shaped release of `versions`: {highest, family, wave, line}, or null when none has that shape.
- * With a `candidate`, a family that already has released tags is judged alone (another family's tags, such as legacy 2.0.1-alpha.N,
- * never outrank the candidate's own line); a family without a tag falls back to the highest release overall.
- */
-export function nextReleases(versions, candidate = null) {
-  const shaped = versions.filter((version) => readable(version) && lineStart(waveOf(version).base));
-  const family = candidate === null ? null : familyOf(candidate);
-  const own = family === null ? [] : shaped.filter((version) => lineStart(waveOf(version).base).family === family);
-  const pool = own.length ? own : shaped;
-  if (!pool.length) return null;
-  const highest = pool.reduce((top, version) => (compareVersions(version, top) > 0 ? version : top));
-  const start = lineStart(waveOf(highest).base);
-  return { highest, family: start.family, wave: nextWave(highest, pool), line: `${start.family}.${start.line + 1}` };
-}
-
-/**
- * Why `version` cannot be released after `released` (the versions already tagged), or null when it can: the next wave of the highest
- * release of its own family, the first release of the next line, or (when its family has no tag) a later release of another label or
- * core than the highest. The legacy `-fix` form is always refused.
- */
-export function releaseVersionRefusal(version, released) {
-  const next = nextReleases(released.filter((entry) => entry !== version), version);
-  const named = next ? `; the next release is ${next.wave} (the next wave or fix after ${next.highest}) or ${next.line} (the next line)` : '';
-  if (waveOf(version).legacy) return `${version} is the legacy -fix form, which is read and never released again${named}`;
-  if (!next || version === next.wave || version === next.line) return null;
-  if (!readable(version)) return `${version} is not a SemVer version${named}`;
-  if (lineStart(waveOf(version).base)?.family !== next.family && compareVersions(version, next.highest) > 0) return null;
-  return `${version} does not follow ${next.highest}${named}`;
-}
-
-/** The versions of the release tags `v<version>` in the output of `git tag --list`. */
-export const taggedVersions = (listing) => String(listing ?? '').split(/\r?\n/).map((name) => name.trim()).filter((name) => /^v\d/.test(name)).map((name) => name.slice(1));

package/runtime/scripts/lib/runtime-location.mjs

@@ -1,21 +0,0 @@
-import { existsSync, readFileSync } from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-
-/** The usable runtime linked for `home`, or null with a diagnostic in `skipped` for a stale or unreadable record. */
-export function readRuntimeRecord({ home = os.homedir(), exists = existsSync, read = readFileSync, skipped = [] } = {}) {
-  const record = path.join(home, '.starci', 'runtime.json');
-  if (!exists(record)) return null;
-  let candidate;
-  try { candidate = JSON.parse(read(record, 'utf8'))?.root; }
-  catch {
-    skipped.push(`${record} is not valid JSON`);
-    return null;
-  }
-  if (typeof candidate === 'string' && candidate) {
-    const root = path.resolve(candidate);
-    if (exists(path.join(root, 'scripts', 'cli', 'main.mjs'))) return { root, source: record };
-  }
-  skipped.push(`${record} points at ${JSON.stringify(candidate ?? null)}, which has no scripts/cli/main.mjs (stale record)`);
-  return null;
-}

package/runtime/scripts/lib/runtime-package-inventory.mjs

@@ -1,21 +0,0 @@
-// The root archive's names equal npm's selection from tracked inputs and verified generated copies.
-import { byCodeUnit } from './list.mjs';
-
-const relativeFile = (file) => typeof file === 'string' && file.length > 0 && !/^[a-z]:/i.test(file) && !file.includes('\0') && !file.includes('\\') && !file.split('/').some((part) => !part || part === '.' || part === '..');
-
-/** Exact selected-set proof; source-byte equality remains owned by verifyPackedDependencies. */
-export function runtimePackageInventory({ files, tracked, generated = [], selected }) {
-  if (!Array.isArray(tracked) || !tracked.length || !tracked.every(relativeFile)) return { unrun: 'the tracked file inventory of the root is unavailable or malformed' };
-  if (!Array.isArray(selected) || !selected.length || !selected.every(relativeFile) || new Set(selected).size !== selected.length) return { unrun: 'npm did not return a complete, unique tracked-projection inventory' };
-  if (!Array.isArray(generated) || !generated.every(relativeFile)) return { unrun: 'the verified generated file inventory is malformed' };
-  const trackedSet = new Set(tracked), generatedSet = new Set(generated), selectedSet = new Set(selected);
-  const unknown = selected.filter((file) => !trackedSet.has(file) && !generatedSet.has(file));
-  if (unknown.length) return { unrun: `npm selected files outside the tracked projection: ${unknown.slice(0, 5).join(', ')}` };
-  const packed = [...files.keys()];
-  const foreign = packed.filter((file) => !file.startsWith('package/') || !selectedSet.has(file.slice('package/'.length))).sort(byCodeUnit);
-  if (foreign.length) return { red: `root archive carries ${foreign.length} file(s) outside npm's tracked-only selection (ignored build output or scratch): ${foreign.slice(0, 5).join(', ')}` };
-  const missing = selected.filter((file) => !files.has(`package/${file}`)).sort(byCodeUnit);
-  if (missing.length) return { red: `root archive omits ${missing.length} file(s) from npm's tracked-only selection: ${missing.slice(0, 5).join(', ')}` };
-  const generatedCount = selected.filter((file) => !trackedSet.has(file) && generatedSet.has(file)).length;
-  return { tracked: selected.length - generatedCount, generated: generatedCount };
-}

package/runtime/scripts/lib/runtime-package-manifests.mjs

@@ -1,84 +0,0 @@
-// Manifests the root archive ships name files by path; a path that does not ship breaks the installed runtime.
-import fs from 'node:fs';
-import path from 'node:path';
-import { parseYaml } from '../../engine/yaml.mjs';
-import { asList, byCodeUnit } from './list.mjs';
-import { EXAMPLES_ROOT } from './example-refs.mjs';
-
-const KNOWLEDGE_SOURCE = 'starci/knowledge-source@1';
-const strings = (value) => asList(value).filter((item) => typeof item === 'string' && item.length > 0);
-const entries = (value) => asList(value).filter((item) => item && typeof item === 'object');
-const joined = (directory, file) => path.posix.normalize(path.posix.join(directory, file));
-
-/** The example catalog: each example's files/entrypoint/projects/tests are relative to that example's own directory. */
-const exampleReferences = (doc) => entries(doc?.examples).flatMap((example) => {
-  const base = path.posix.join(EXAMPLES_ROOT, String(example.path ?? ''));
-  return [...strings(example.files), ...strings(example.entrypoint), ...strings(example.projects), ...strings(example.tests)]
-    .map((file) => ({ from: String(example.id ?? '?'), target: joined(base, file) }));
-});
-
-/** The schema catalog: schemas[].file and every moduleLocalDocumentKinds[].files entry are relative to the package root. */
-const schemaReferences = (doc) => [
-  ...entries(doc?.schemas).flatMap((schema) => strings(schema.file).map((file) => ({ from: String(schema.id ?? '?'), target: joined('.', file) }))),
-  ...entries(doc?.moduleLocalDocumentKinds).flatMap((kind) => strings(kind.files).map((file) => ({ from: String(kind.id ?? '?'), target: joined('.', file) }))),
-];
-
-/** The path-bearing keys of a grammar family entry. */
-const FAMILY_PATH_KEYS = ['authority', 'packageSnapshot', 'reusableStyle', 'productComposition', 'index'];
-
-/** A knowledge-source index: branches[].path, topics[].path and the family files, relative to the index's own directory. */
-const knowledgeReferences = (directory) => (doc) => [
-  ...entries(doc?.branches).flatMap((branch) => strings(branch.path).map((file) => ({ from: String(branch.id ?? '?'), target: joined(directory, file) }))),
-  ...entries(doc?.topics).flatMap((topic) => strings(topic.path).map((file) => ({ from: String(topic.title ?? '?'), target: joined(directory, file) }))),
-  ...entries(doc?.families).flatMap((family) => FAMILY_PATH_KEYS.flatMap((key) => strings(family[key]).map((file) => ({ from: `${family.id ?? '?'}.${key}`, target: joined(directory, file) })))),
-];
-
-/** Manifests the package must ship; their absence from the selection is red, never a skip. */
-export const REQUIRED_MANIFESTS = Object.freeze([`${EXAMPLES_ROOT}/index.yaml`, 'modules/schemas/index.yaml', 'knowledge/index.yaml']);
-
-const KNOWLEDGE_INDEX = /^knowledge\/(?:.+\/)?index\.yaml$/;
-
-/** The reader of one manifest file: the two catalogs have their own, every knowledge index reads its own directory. */
-const readerOf = (file) => {
-  if (file === REQUIRED_MANIFESTS[0]) return exampleReferences;
-  if (file === REQUIRED_MANIFESTS[1]) return schemaReferences;
-  return knowledgeReferences(path.posix.dirname(file));
-};
-
-/** The manifests to read: the required set plus every selected knowledge index. */
-const manifestFiles = (selected) => [...new Set([...REQUIRED_MANIFESTS, ...selected.filter((name) => KNOWLEDGE_INDEX.test(name))])].sort(byCodeUnit);
-
-/** {references} of one manifest, {skip} for an index of another schema, {unrun} or {red} when it cannot be trusted. */
-function readManifest(file, readFile) {
-  let doc;
-  try { doc = parseYaml(readFile(file)); } catch { return { unrun: `${file} is unreadable or not valid YAML` }; }
-  if (doc?.schema !== KNOWLEDGE_SOURCE && !REQUIRED_MANIFESTS.includes(file)) return { skip: true };
-  const references = readerOf(file)(doc);
-  if (!references.length) return { red: `${file} yields no file references; its reference keys changed or it lists nothing, so nothing in it would be checked` };
-  return { references };
-}
-
-/**
- * Pre-pack admission: every path a shipped manifest names must be in the archive selection. Manifests are the required
- * set plus every selected knowledge index stamped starci/knowledge-source@1, so a new index is covered unlisted.
- * Returns {unrun} when a manifest cannot be read, {red} naming the first unresolved paths, else {manifests, references, counts}.
- */
-export function manifestAdmission({ root, selected, readFile = (file) => fs.readFileSync(path.join(root, file), 'utf8') }) {
-  const shipped = new Set(selected);
-  const missing = REQUIRED_MANIFESTS.filter((file) => !shipped.has(file));
-  if (missing.length) return { red: `the archive does not ship required manifest(s): ${missing.join(', ')}` };
-  const gaps = [];
-  const counts = {};
-  for (const file of manifestFiles(selected)) {
-    const read = readManifest(file, readFile);
-    if (read.unrun || read.red) return read;
-    if (read.skip) continue;
-    counts[file] = read.references.length;
-    for (const { from, target } of read.references) if (target.startsWith('../') || !shipped.has(target)) gaps.push(`${file} (${from}) -> ${target}`);
-  }
-  if (gaps.length) {
-    const sorted = [...new Set(gaps)].sort(byCodeUnit);
-    return { red: `${sorted.length} shipped manifest reference(s) do not resolve in the archive: ${sorted.slice(0, 5).join('; ')}` };
-  }
-  return { manifests: Object.keys(counts).length, references: Object.values(counts).reduce((sum, count) => sum + count, 0), counts };
-}

package/runtime/scripts/lib/runtime-publication-tags.mjs

@@ -1,56 +0,0 @@
-// The release owner's dist-tag judgment and idempotent reconciliation, independent of npm processes.
-import { compareVersions, releaseLine, versionParts } from './release-version.mjs';
-
-/**
- * Plan the release's declared tags from a complete registry read. Unknown reads and historical
- * releases fail closed (alpha.31.1 is behind alpha.31.2 and alpha.32 on the one alpha line); a newer
- * tag on another release line is preserved rather than rolled back.
- * Returns serializable {tag, version, current, action} entries for the native dry-run plan.
- */
-export function runtimeTagPlan({ version, tags, state, uploadTag = null }) {
-  versionParts(version);
-  if (!Array.isArray(tags) || !tags.length || tags.some((tag) => typeof tag !== 'string' || !/^[a-z][a-z0-9-]*$/i.test(tag)))
-    throw new Error('runtime publication requires declared npm dist-tags');
-  if (!['present', 'absent'].includes(state?.state) || !Array.isArray(state.versions) || !state.distTags || Array.isArray(state.distTags) || typeof state.distTags !== 'object')
-    throw new Error('runtime dist-tags and version inventory could not be read');
-  if (state.state === 'present' && !state.versions.includes(version)) throw new Error('runtime version inventory omits the published release');
-  const newer = state.versions.find((entry) => releaseLine(entry) === releaseLine(version) && compareVersions(entry, version) > 0);
-  if (newer) throw new Error(`runtime release ${version} is behind ${newer} on its release line; dist-tags cannot move backwards`);
-  const plan = [...new Set(tags)].map((tag) => {
-    const current = state.distTags[tag] ?? null;
-    if (current !== null && typeof current !== 'string') throw new Error(`unreadable npm dist-tag ${tag}`);
-    const compared = current === null ? -1 : compareVersions(current, version);
-    let action = current === version ? 'confirmed' : 'set';
-    if (compared > 0) action = 'preserve';
-    return { tag, version: compared > 0 ? current : version, current,
-      action };
-  });
-  if (uploadTag && plan.some((entry) => entry.tag === uploadTag && entry.action === 'preserve'))
-    throw new Error(`runtime upload channel ${uploadTag} points to a newer release; publication cannot move it backwards`);
-  return plan;
-}
-
-/**
- * Repair only stale declared tags of an integrity-confirmed runtime version, then read every tag
- * back. The registry seam owns effects; a failed write/read throws and can be retried without upload.
- */
-export function reconcileRuntimeTags({ row, tags, registry, out, sleep = null, waitMs = 0, stepMs = 5000 }) {
-  const state = registry.state(row.name, row.version);
-  if (state.state !== 'present' || state.integrity !== row.registry.integrity) throw new Error('runtime registry integrity changed before dist-tag reconciliation');
-  const plan = runtimeTagPlan({ version: row.version, tags, state });
-  for (const entry of plan.filter((item) => item.action === 'set')) {
-    const result = registry.tag(row.name, row.version, entry.tag);
-    if (!result.ok) throw new Error(`npm dist-tag ${entry.tag} failed (exit ${result.status ?? 'unknown'})`);
-  }
-  // Registry propagation of a tag write can lag; poll the read-back inside the window before calling it stale.
-  const deadline = Date.now() + waitMs;
-  let confirmed = registry.state(row.name, row.version);
-  while (sleep && Date.now() < deadline && plan.some((entry) => confirmed.distTags?.[entry.tag] !== entry.version)) {
-    sleep(stepMs);
-    confirmed = registry.state(row.name, row.version);
-  }
-  if (confirmed.state !== 'present' || confirmed.integrity !== state.integrity || plan.some((entry) => confirmed.distTags?.[entry.tag] !== entry.version))
-    throw new Error('runtime dist-tag read-back did not confirm the declared targets and immutable integrity');
-  for (const entry of plan) out(`  dist-tag ${row.name}@${entry.version} ${entry.tag}: ${entry.action === 'preserve' ? 'newer release preserved' : 'confirmed by registry read-back'}`);
-  return plan;
-}

package/runtime/scripts/lib/seat-env.mjs

@@ -1,43 +0,0 @@
-// seat-env.mjs — the seat identity one Orca terminal's environment claims, and the env a runtime child gets.
-//
-// Orca exports the terminal's identity into the shell it owns (ORCA_TERMINAL_HANDLE, ORCA_PANE_KEY, ORCA_TAB_ID,
-// ORCA_WORKTREE_ID, ORCA_AGENT_* — the agent hook endpoint and token included), and a session can carry the caller
-// markers STARCI_ROLE, STARCI_GUARD_FILE and STARCI_CALLER. Caller and guard logic binds a process to a seat by those
-// variables (scripts/guards/op-caller.mjs callerOf, scripts/guards/command-policy.mjs shimDecision, the seat bindings of
-// scripts/guards/hook-install.mjs), so a child the runtime spawns for its own work — the package proof of the land gate,
-// the scaffold e2e, a staging `npm ci` and its lifecycle scripts — that inherits them is admitted as
-// the seat: a supervisor seat's `node install.js` reads as a raw supervisor tool call (RIGHTS_RAW_TOOL) and a spec's
-// kernel call resolves the seat's custody (kernel-caller-unknown). The seat's own agent tool calls keep the identity;
-// every other child of it gets this env.
-//
-// The seat's PATH can likewise carry the per-user guard-shim directory first (<home>/.starci/bin,
-// packages/cli/src/shim.mjs writeRuntimeShim — put there by scripts/agent/starci-shim.mjs addStarciShimToPath): its
-// wrappers judge `node`, `git`, `npm` and friends through shimDecision before reaching the real tool. Without the
-// seat identity a wrapper binds no role and passes through, but a runtime child that never answers to the seat —
-// the codex app-server probe, whose `codex` launcher resolves `node` through PATH — also gets PATH without the shim
-// directory, so nothing it spawns is ever re-judged.
-import os from 'node:os';
-import path from 'node:path';
-
-/** The variables that bind a process to the calling seat or claim a caller identity. */
-const SEAT_ENV_VARS = Object.freeze(['ORCA_TERMINAL_HANDLE', 'ORCA_PANE_KEY', 'ORCA_TAB_ID', 'ORCA_WORKTREE_ID', 'STARCI_ROLE', 'STARCI_GUARD_FILE', 'STARCI_CALLER']);
-
-/** `parent` (the caller's env) without the seat identity: a child that is not the seat's own agent tool call runs unbound. Pure — the caller names the env; the base tier never reads process.env itself (RT_BASE_IMPURE). */
-export function withoutSeatEnv(parent) {
-  const env = { ...parent };
-  for (const key of Object.keys(env)) if (SEAT_ENV_VARS.includes(key) || key.startsWith('ORCA_AGENT_')) delete env[key];
-  return env;
-}
-
-/** `parent` without the guard-shim directory on PATH (any casing of the PATH key, the one <home>/.starci/bin entry wherever it sits). Pure — the caller names the env; `home`/`platform` are injectable seams. */
-export function withoutSeatShim(parent, { home = os.homedir(), platform = process.platform } = {}) {
-  const env = { ...parent };
-  const key = Object.keys(env).find((name) => name.toLowerCase() === 'path');
-  if (!key) return env;
-  const shim = path.resolve(path.join(home, '.starci', 'bin'));
-  const resolved = (entry) => path.resolve(String(entry).replace(/^"(.*)"$/, '$1'));
-  const same = (entry) => platform === 'win32' ? resolved(entry).toLowerCase() === shim.toLowerCase() : resolved(entry) === shim;
-  const delimiter = platform === 'win32' ? ';' : ':';
-  env[key] = String(env[key]).split(delimiter).filter((entry) => entry && !same(entry)).join(delimiter);
-  return env;
-}

package/runtime/scripts/lib/sonar-new-code.mjs

@@ -1,58 +0,0 @@
-// sonar-new-code.mjs - the New Code definition a Sonar project is ensured with, and how each provider stores and reads it back. Pure.
-// Without a New Code definition a SonarQube Cloud project's gate status is NONE and the scanner's quality-gate wait reports the gate
-// "not set" (alpha.27: two example projects carried the gate but no New Code definition). The canonical
-// period is knowledge/sonar-gate.yaml `gate.newCodePeriod` of the repository's edition; a stack target may declare its own
-// `resource.newCodePeriod` of the same shape. SonarQube Server and Community Build store it through api/new_code_periods; SonarQube
-// Cloud has no such web service and keeps it as the project setting `sonar.leak.period` (a number of days, or `previous_version`).
-
-/** The period types a declaration may name, and whether each carries a value. */
-const NEW_CODE_TYPES = Object.freeze({ NUMBER_OF_DAYS: 'days', PREVIOUS_VERSION: 'none' });
-/** The setting SonarQube Cloud keeps a project's New Code definition in. */
-export const CLOUD_NEW_CODE_SETTING = 'sonar.leak.period';
-const MAX_DAYS = 90;
-
-/** A period of a closed shape: {type: NUMBER_OF_DAYS, value: 1..90} or {type: PREVIOUS_VERSION}; throws on anything else. */
-export function newCodePeriodOf(period) {
-  if (!period || typeof period !== 'object' || Array.isArray(period)) throw new Error('Invalid declared new code period');
-  const keys = Object.keys(period);
-  if (!keys.every((key) => key === 'type' || key === 'value') || !Object.hasOwn(NEW_CODE_TYPES, period.type)) throw new Error('Invalid declared new code period');
-  if (period.type === 'PREVIOUS_VERSION') {
-    if (period.value !== undefined) throw new Error('Invalid declared new code period');
-    return { type: 'PREVIOUS_VERSION' };
-  }
-  if (!Number.isInteger(period.value) || period.value < 1 || period.value > MAX_DAYS) throw new Error('Invalid declared new code period');
-  return { type: 'NUMBER_OF_DAYS', value: period.value };
-}
-
-/** The period a project target is ensured with: its own `resource.newCodePeriod` when declared, else the canonical one of the gate. */
-export function declaredNewCodePeriod(resource, canonical) {
-  return newCodePeriodOf(resource?.newCodePeriod ?? canonical);
-}
-
-/** The value SonarQube Cloud stores in `sonar.leak.period` for `period`. */
-export const cloudLeakValue = (period) => (period.type === 'PREVIOUS_VERSION' ? 'previous_version' : String(period.value));
-
-/**
- * The write that sets `period` on `projectKey` for `provider`: {kind: 'setting', key, value} on SonarQube Cloud, else
- * {kind: 'period', form: {project, type, value?}} for api/new_code_periods/set.
- */
-export function newCodeWrite(provider, projectKey, period) {
-  if (provider === 'sonar-cloud') return { kind: 'setting', key: CLOUD_NEW_CODE_SETTING, value: cloudLeakValue(period) };
-  return { kind: 'period', form: { project: projectKey, type: period.type, ...(period.value === undefined ? {} : { value: String(period.value) }) } };
-}
-
-/**
- * Whether a provider's readback holds `period`: on SonarQube Cloud the api/settings/values answer ({settings: [{key, value}]}),
- * elsewhere the api/new_code_periods/show answer ({type, value}). A missing definition, another type or another value is no match.
- */
-export function newCodeMatches(provider, readback, period) {
-  if (provider === 'sonar-cloud') {
-    const row = (readback?.settings ?? []).find((setting) => setting?.key === CLOUD_NEW_CODE_SETTING);
-    return row?.value === cloudLeakValue(period);
-  }
-  if (readback?.type !== period.type) return false;
-  return period.value === undefined || String(readback.value) === String(period.value);
-}
-
-/** The public proof of an ensured period: `NUMBER_OF_DAYS:30` or `PREVIOUS_VERSION`. */
-export const newCodeProof = (period) => (period.value === undefined ? period.type : `${period.type}:${period.value}`);